EUVD-2026-29618
GHSA-v3rx-xwp8-9px7
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
File open triggers local parser read overrun requiring user action (UI:R/AV:L/PR:N); read-only flaw means C:H only, no integrity or availability impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Illustrator versions 29.8.6, 30.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Out-of-bounds read in Adobe Illustrator 29.8.6, 30.3 and earlier exposes sensitive process memory to disclosure when a victim opens a specially crafted file. The CVSS vector confirms a local-execution context with high confidentiality impact and no integrity or availability impact, consistent with a file-parser memory leak rather than code execution. No public exploit code or active exploitation has been identified at time of analysis, and EPSS at 0.02% (6th percentile) reflects minimal observed exploitation pressure.
Technical ContextAI
The vulnerability is rooted in CWE-125 (Out-of-Bounds Read), a class where a file parser reads beyond the intended bounds of a buffer, potentially exposing adjacent heap or stack memory to the application - and thereby to a crafted file's author. Adobe Illustrator's file-parsing engine processes complex vector graphics formats (.ai, .eps, .svg, etc.) that require intricate boundary-checked reads; a malformed length or offset field in a crafted document can shift the read pointer outside allocated memory. The CPE string cpe:2.3:a:adobe:illustrator covers all platforms, indicating the flaw is not OS-specific. Note that the 'Buffer Overflow' tag in the intelligence feed is a mislabeling - CWE-125 is a read overrun, not a write overrun, which limits the impact to information disclosure rather than code execution.
RemediationAI
The primary remediation is to apply the update documented in Adobe security bulletin APSB26-51 (https://helpx.adobe.com/security/products/illustrator/apsb26-51.html), which addresses this and related issues in the 29.x and 30.x release lines. The specific patched version number is not independently confirmed from the available input data - consult APSB26-51 directly for the exact target version before updating. As a compensating control while patching is scheduled, restrict Illustrator users from opening files received from untrusted external sources by enforcing email attachment sandboxing and disabling automatic file-association handlers for .ai and .eps files. This limits the delivery vector without breaking Illustrator functionality for internally sourced files. No workaround fully mitigates the vulnerability short of patching, since the flaw is in the file-parsing engine itself.
More in Illustrator
View allAdobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to e
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Arbitrary code execution in Adobe Illustrator 2025 (≤29.8.7) and 2026 (≤30.5) allows an attacker to run code in the cont
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a Path Traversal vulnerability when parsing a specially craf
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today